Nginx doesn’t listen to HTTPS requests for subdomains

Question

I have a Nginx server that is hosting both the main domain foo.com and a subdomain bar.foo.com for a website. I only have a certificate for my main domain, so I only want HTTP requests for the subdomain. I have configured both server blocks, and all requests work well: http://foo.com will be redirected to https://foo.com, and http://bar.foo.com just stays on HTTP.

However, a problem rises when I tried to connect https://bar.foo.com, although I have not configured the subdomain server block to listen for 443 or ssl requests, the request is still handled, and after getting a warning from the browser that the certificate has a different host name than the one I am requesting, the page I get is from the main domain foo.com.

So, apparently, the server block that was supposed to only listen to HTTPS requests of my main domain, somehow is also listening to HTTPS requests of the subdomain, I don't want this to happen.

Here is my configuration for the main domain:

server {
  listen       80;
  server_name  foo.com www.foo.com;

  return 301 https://$server_name$request_uri;
}

server {
  listen       443 ssl;
  server_name  foo.com www.foo.com;

  ssl                  on;
  ssl_certificate      /etc/nginx/cert/foo.com.pem;
  ssl_certificate_key  /etc/nginx/cert/foo.com.key;
  ...

  location / {
    root   /var/www/foo.com/public_html;
    index  index.html index.htm;
  }
}

Here is my configuration for the subdomain:

server {
  listen       80;
  server_name  bar.foo.com www.bar.foo.com;

  location / {
    root   /var/www/bar.foo.com/public_html;
    index  index.html index.htm;
  }
}

And here is a snippet of the Nginx configuration file:

server {
  listen       80 default_server;
  listen       [::]:80 default_server;
  server_name  _;
  root         /usr/share/nginx/html;

  location / {
}

I have tried deleting foo.com after listen in the 443 server block of my main domain, but it doesn't help.

I would like Nginx either not listen to requests such as https://bar.foo.com or to simply return 404 or 444.

Answer 1

Since you have only one server block configured for port 443, it is the default virtual server used by nginx to service all requests to port 443.

To add a default server for port 443 (TLS), you can add the following virtual host:

server {
    listen 443 default_server;
    server_name _;
    return 444;
}

Answer 2

I have figured out the solution. Just like @Tero and @Cosmic correctly pointed out, my only 443 server block for the main domain is being set to the default server block for all 443 requests.

I commented the server block in the Nginx configuration file /etc/nginx/nginx.conf and added the following two server blocks:

server {
  listen      80 default_server;
  server_name  _;
  return 444;
}

server {
  listen       443 ssl default_server;
  server_name  _;
  ssl_certificate      /etc/nginx/cert/foo.bar.pem;
  ssl_certificate_key  /etc/nginx/cert/foo.bar.key;
  return 444;
}

The first one will be set to the default server block for any HTTP requests, dropping any unmatched requests, and similarly the second one will drop any unmatched 443 or HTTPS requests.

The solution that @Tero provided won't work, because Nginx expects a certificate for any SSL server blocks, so you will need to provide it with a certificate.